Home page logo

fulldisclosure logo Full Disclosure mailing list archives

Re: Gmail Information Disclosure Vulnerability
From: System Outage <system_outage () yahoo com>
Date: Mon, 5 Jul 2004 09:00:20 -0700 (PDT)

If it's about posting advisories, why do many decide to post the exploit along with the advisory. To me this is not a 
responsible thing to do. Whoever knows how many script kiddies are sleeping on this list and taking advantage of the 
free exploit giveaway's seen here.
10 days isn't an awful long time and the vendor never made primary contact with the user in question. Meaning, for 
whatever reason the e-mail may not have been delivered and because of this the Gmail Team could easily of been caught 
short on this issue and a serious hole exposed to the public, before the vendor (Gmail) has had a chance to scramble 
together an incident response and get the hole patched out, before a serious number of account's become compromised on 
the service.
There is a difference between responsible "Full Disclosure" and irresponsible "Full Disclosure".

Tremaine <tremaine () gmail com> wrote:
It's about posting security advisories. The initial poster advises
they notified the gmail team, and posted this advisory 10 days later.

It is immaterial whether an application is in alpha, beta or
production. If the software or application is in use outside the
development team, and there is a security issue, it is relevant to
this list.

It's called Full Disclosure for a reason... not partial disclosure,
not disclosure of production applications only... Full Disclosure.

If you want partial disclosure, you may need to rethink your
subscription to the list.

IT Security Consultant

----- Original Message -----
From: System Outage 
Date: Mon, 5 Jul 2004 06:46:42 -0700 (PDT)
Subject: Re: [Full-disclosure] Gmail Information Disclosure Vulnerability
To: full-disclosure () lists netsys com

If it's not about respect then what is it about? 

You have no respect for the Gmail Team, that's for sure.

I guess this list isn't about respect...

It's about kiddies posting advisories and exploits for fun and little
care for the vendor(s).


amforward () mailsurf com wrote:
System Outage wrote:

|The correct channel to post such "bugs" is the Gmail contact link for "bug 

I have already contacted Gmail about 10 days ago, but I have not received any 
replies till this moment.

|If you had waited until the Gmail dev team declared gmail a public release, 
|you would have gained more respect in the security community scene.

I don't think this is about respect afterall.

Ahmed Motaz

Mailsurf.com your communication portal for SMS,
Email, Fax, E-Cards and more. www.mailsurf.com

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Do you Yahoo!?
Yahoo! Mail - Helps protect you from nasty viruses.

Full-Disclosure - We believe in it.
Charter: http://lists.netsys.com/full-disclosure-charter.html

Do You Yahoo!?
Tired of spam?  Yahoo! Mail has the best spam protection around 

  By Date           By Thread  

Current thread:
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]